flp2midi-win-arm[.]7z

Sharing

Copy URL Twitter E-mail

General

Target

flp2midi-win-arm.7z
Size

6.6MB
MD5

26058ca129e0bd0cf91c8edc400bc790
SHA1

94091e48308343f55ed8a4f2cf36c9be94ba3d42
SHA256

46e6ee26557278bfa522ca6c6a76f509547d694d4267ed854401989710a40fc3
SHA512

7272eca13f1e0b7a9ef010c18ce1b3936fef8156048e7c274931ebb07664a6b577e3fda72b49d61d9563fc8a23cfc0152d697a667575172eab464cc39c608e3c
SSDEEP

196608:pdz2T6QCdGAhDQSHMFDk1y2rWVUkx5R6d4c4fglgy:pdz1QCdGAhDJH6WyJV5xL6d4cVl5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/flp2midi.exe

Files

flp2midi-win-arm.7z
.7z
clrcompression.dll
.dll windows:6 windows

a892a730ec0b919cad491d223a3914d2

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:c1:72:a6:0f:91:63:1f:95:05:1d:0f:b1:08:ea:dd:a8:5a:10:3f:66:1e:71:e4:2a:f9:75:e5:81:e1:bd:46
Signer

Actual PE Digest

0d:c1:72:a6:0f:91:63:1f:95:05:1d:0f:b1:08:ea:dd:a8:5a:10:3f:66:1e:71:e4:2a:f9:75:e5:81:e1:bd:46

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\workspace\_work\1\s\artifacts\obj\native\net5.0-Windows_NT-Release-arm\clrcompression\Release\clrcompression.pdb

Imports

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsProcessorFeaturePresent
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
DeleteCriticalSection

api-ms-win-crt-heap-l1-1-0

free
calloc
malloc

api-ms-win-crt-math-l1-1-0

log2

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
terminate
_seh_filter_dll
_initterm
_configure_narrow_argv
abort
_initterm_e
exit

Exports

Exports

BrotliDecoderCreateInstance
BrotliDecoderDecompress
BrotliDecoderDecompressStream
BrotliDecoderDestroyInstance
BrotliDecoderErrorString
BrotliDecoderGetErrorCode
BrotliDecoderHasMoreOutput
BrotliDecoderIsFinished
BrotliDecoderIsUsed
BrotliDecoderSetParameter
BrotliDecoderTakeOutput
BrotliDecoderVersion
BrotliEncoderCompress
BrotliEncoderCompressStream
BrotliEncoderCreateInstance
BrotliEncoderDestroyInstance
BrotliEncoderHasMoreOutput
BrotliEncoderIsFinished
BrotliEncoderMaxCompressedSize
BrotliEncoderSetParameter
BrotliEncoderTakeOutput
BrotliEncoderVersion
BrotliGetDictionary
BrotliSetDictionaryData
CompressionNative_Crc32
CompressionNative_Deflate
CompressionNative_DeflateEnd
CompressionNative_DeflateInit2_
CompressionNative_Inflate
CompressionNative_InflateEnd
CompressionNative_InflateInit2_

Sections

.text
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 440KB - Virtual size: 440KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
clrjit.dll
.dll windows:6 windows

30da1dce0529c017fec28e8c46b39c21

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c7:58:71:66:4c:ed:32:32:f8:78:bc:96:96:9e:75:fd:bd:46:02:55:77:61:9f:99:af:6f:29:03:01:a5:12:75
Signer

Actual PE Digest

c7:58:71:66:4c:ed:32:32:f8:78:bc:96:96:9e:75:fd:bd:46:02:55:77:61:9f:99:af:6f:29:03:01:a5:12:75

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\workspace\_work\1\s\artifacts\obj\coreclr\Windows_NT.arm.Release\src\jit\standalone\Release\clrjit.pdb

Imports

kernel32

RaiseException
DebugBreak
OutputDebugStringA
WideCharToMultiByte
QueryPerformanceFrequency
QueryPerformanceCounter
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryThreadCycleTime
GetCurrentThread
HeapFree
GetLastError
GetCurrentThreadId
GetSystemTimeAsFileTime
SetLastError
GetCurrentProcessId
InitializeSListHead
IsProcessorFeaturePresent
RtlLookupFunctionEntry
RtlUnwindEx
InterlockedFlushSList
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InitializeCriticalSectionEx
RtlPcToFileHeader

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
_fileno
__acrt_iob_func
_wfopen
fclose
_dup
_setmode
setvbuf
ftell
fseek

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
abort
_cexit
_execute_onexit_table
_errno
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
terminate

api-ms-win-crt-math-l1-1-0

ceilf
ceil
cos
_copysign
sinf
cosf
_fdopen
floor
sin
fmod
_finite
floorf

api-ms-win-crt-string-l1-1-0

strncmp
strlen
strcmp
strcpy_s
strcat_s

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc

Exports

Exports

getJit
jitStartup

Sections

.text
Size: 578KB - Virtual size: 578KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coreclr.dll
.dll windows:6 windows

113a8bec8744f12bc78ee491a9c1e7cb

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e8:a8:3b:e2:59:c2:34:2c:82:7b:24:83:bd:f2:ed:51:66:67:94:32:42:24:08:62:e6:67:6c:92:a0:19:5a:b8
Signer

Actual PE Digest

e8:a8:3b:e2:59:c2:34:2c:82:7b:24:83:bd:f2:ed:51:66:67:94:32:42:24:08:62:e6:67:6c:92:a0:19:5a:b8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\workspace\_work\1\s\artifacts\obj\coreclr\Windows_NT.arm.Release\src\dlls\mscoree\coreclr\Release\coreclr.pdb

Imports

kernel32

SetUnhandledExceptionFilter
RtlVirtualUnwind
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
GetTickCount
CreateFileMappingW
RtlAddFunctionTable
RtlDeleteFunctionTable
GetFileSize
RtlLookupFunctionEntry
HeapFree
InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount64
DuplicateHandle
QueueUserAPC
WaitForSingleObjectEx
SetThreadPriority
GetThreadPriority
ResumeThread
GetCurrentThreadId
Sleep
GetCurrentThread
CreateThread
WaitForMultipleObjectsEx
SignalObjectAndWait
RtlCaptureContext
SetThreadStackGuarantee
VirtualQuery
GetStdHandle
WideCharToMultiByte
GetConsoleOutputCP
MapViewOfFileEx
UnmapViewOfFile
GetStringTypeExW
SetEvent
GetCurrentProcessorNumber
GlobalMemoryStatusEx
CreateIoCompletionPort
PostQueuedCompletionStatus
SleepEx
GetQueuedCompletionStatus
GetCurrentProcessorNumberEx
ExitProcess
GetActiveProcessorGroupCount
GetActiveProcessorCount
GetSystemTime
GetSystemTimeAsFileTime
CreateMemoryResourceNotification
GetProcessAffinityMask
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx
GetLargePageMinimum
VirtualUnlock
ResetWriteWatch
GetWriteWatch
GetLogicalProcessorInformation
SetThreadGroupAffinity
SetThreadAffinityMask
IsProcessInJob
QueryInformationJobObject
K32GetProcessMemoryInfo
VirtualAlloc
VirtualFree
VirtualProtect
SwitchToThread
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateEventW
ResetEvent
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
GetThreadContext
SuspendThread
TerminateProcess
RtlRestoreContext
GetSystemDefaultLCID
GetUserDefaultLCID
RtlInstallFunctionTableCallback
RtlUnwind
HeapAlloc
GetProcessHeap
HeapCreate
HeapDestroy
FormatMessageW
GetACP
LCMapStringEx
IsDBCSLeadByte
LocalFree
IsWow64Process
GetModuleFileNameW
VirtualAllocExNuma
GetNumaProcessorNodeEx
GetNumaHighestNodeNumber
GetSystemTimes
CreateProcessW
GetCPInfo
LoadLibraryExW
CreateFileW
GetFileAttributesExW
GetCurrentDirectoryW
GetFullPathNameW
OpenProcess
OpenEventW
ExitThread
CreateNamedPipeA
WaitForMultipleObjects
DisconnectNamedPipe
CreateFileA
CancelIoEx
GetOverlappedResult
CreateEventA
ConnectNamedPipe
FlushFileBuffers
MapViewOfFile
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
SetConsoleCtrlHandler
GetLocaleInfoEx
GetUserDefaultLocaleName
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
RtlUnwindEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InitializeCriticalSectionEx
RtlPcToFileHeader
UnhandledExceptionFilter
GetCurrentProcessId
RaiseFailFastException
RaiseException
WaitForSingleObject
SetLastError
FreeLibrary
GetModuleHandleW
GetSystemInfo
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLastError
InterlockedPopEntrySList
WriteFile
GetProcessTimes
GetCommandLineW
ReadFile
SetFilePointer
GetProcAddress
GetModuleHandleExW
SetErrorMode
CloseHandle
FlushProcessWriteBuffers
FlushInstructionCache
GetCurrentProcess
OutputDebugStringW
DebugBreak
LoadLibraryExA
MultiByteToWideChar
SetThreadContext

advapi32

RegisterEventSourceW
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
DeregisterEventSource
ReportEventW
RegEnumValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
EventRegister
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
SetThreadToken
RevertToSelf
OpenThreadToken
EventWriteTransfer
EventWrite
SetKernelObjectSecurity

ole32

CoCreateFreeThreadedMarshaler
StringFromGUID2
CoGetContextToken
CoGetObjectContext
CoUnmarshalInterface
CoMarshalInterface
CoGetClassObject
CreateStreamOnHGlobal
IIDFromString
CoReleaseMarshalData
CLSIDFromProgID
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoInitializeEx
CoRegisterInitializeSpy
CoWaitForMultipleHandles
CoUninitialize
CoRevokeInitializeSpy
CoGetMarshalSizeMax

oleaut32

SafeArrayDestroy
CreateErrorInfo
LoadRegTypeLi
SafeArrayPutElement
SafeArrayCreateVector
SysAllocStringByteLen
SysStringByteLen
SafeArrayGetRecordInfo
SafeArrayGetElemsize
SafeArrayAllocData
SafeArraySetRecordInfo
GetRecordInfoFromTypeInfo
SafeArrayAllocDescriptorEx
VarCyFromDec
VariantInit
VariantClear
VariantChangeTypeEx
VariantChangeType
SafeArrayGetVartype
LoadTypeLibEx
SetErrorInfo
SysFreeString
GetErrorInfo
SysAllocString
SysStringLen
SysAllocStringLen
SafeArrayGetDim
SafeArrayGetLBound
QueryPathOfRegTypeLi

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

strncpy_s
iswspace
iswupper
towlower
strtok_s
isalpha
isdigit
wcsnlen
strncmp
_wcsicmp
strncat_s
strcat_s
wcsncat_s
_wcsnicmp
strnlen
_strnicmp
_stricmp
towupper
wcscat_s
iswascii
strcmp
strlen
strcpy_s
wcsncpy_s
wcscpy_s
wcslen
wcsncmp
wcscmp
wcsncpy

api-ms-win-crt-convert-l1-1-0

_itow_s
_ltow_s
strtoul
_wtoi
wcstoul
_wcstoui64
atol
atoi

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
fopen
__stdio_common_vswprintf_s
_putws
fputs
__stdio_common_vsnwprintf_s
fwrite
__stdio_common_vsnprintf_s
__stdio_common_vsscanf
fgets
fclose
_wfopen
__stdio_common_vsprintf_s
__acrt_iob_func
fflush
__stdio_common_vfwprintf
_flushall

api-ms-win-crt-runtime-l1-1-0

_errno
_configure_narrow_argv
_invalid_parameter_noinfo
_controlfp_s
_initterm_e
abort
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
terminate
_execute_onexit_table
_crt_atexit
_cexit
_initterm

api-ms-win-crt-utility-l1-1-0

qsort
bsearch

api-ms-win-crt-math-l1-1-0

tanhf
ceil
ceilf
tanf
tan
atanf
atan2f
sinhf
atan2
atan
asinf
asin
acosf
acos
sinh
cosf
tanh
cosh
sinf
coshf
sin
powf
exp
pow
logf
log10f
log2f
scalbnf
acoshf
cbrtf
atanhf
log10
floor
ilogbf
asinhf
cos
log
asinh
cbrt
fmodf
fmod
ilogb
acosh
scalbn
modff
modf
_finite
_copysign
atanh
log2
fmaf
expf
fma
floorf

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-filesystem-l1-1-0

_wmakepath_s
_wsplitpath_s

Exports

Exports

CLRJitAttachState
GetCLRRuntimeHost
MetaDataGetDispenser
coreclr_create_delegate
coreclr_execute_assembly
coreclr_initialize
coreclr_shutdown
coreclr_shutdown_2
g_CLREngineMetrics

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.CLR_UEF
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.clrwb
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
flp2midi.exe
.exe windows:6 windows

331c82bc32c3d35ffa3dd08e9e7b1d9c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\workspace\_work\1\s\artifacts\obj\win-arm.Release\corehost\cli\apphost\static\Release\singlefilehost.pdb

Imports

shell32

ShellExecuteW

advapi32

DeregisterEventSource
ReportEventW
RegisterEventSourceW

kernel32

SetThreadpoolWait
CloseThreadpoolWait
GetModuleHandleW
OutputDebugStringW
CreateDirectoryW
GetFileSizeEx
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetEnvironmentVariableW
GetTempPathW
FindClose
CreateFileW
MultiByteToWideChar
GetLastError
GetFileAttributesExW
LoadLibraryA
CloseHandle
GetCurrentDirectoryW
GetProcAddress
DeleteCriticalSection
WideCharToMultiByte
CreateFileMappingW
MapViewOfFile
IsWow64Process
LoadLibraryExW
RemoveDirectoryW
Sleep
GetCurrentProcessId
UnmapViewOfFile
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InitializeCriticalSectionEx
GetProcessAffinityMask
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
GetThreadTimes
GetCurrentThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadGroupAffinity
GetThreadGroupAffinity
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformationEx
GetTickCount64
GetCurrentProcessorNumberEx
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateEventExW
SetEvent
CreateTimerQueue
LoadLibraryW
VirtualFree
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
CreateSemaphoreExW
ReleaseSemaphore
GetSystemTimePreciseAsFileTime
LCMapStringEx
DecodePointer
GetExitCodeThread
SwitchToThread
WaitForSingleObjectEx
TryEnterCriticalSection
TryAcquireSRWLockExclusive
InitializeSRWLock
SleepConditionVariableCS
WakeConditionVariable
InitializeConditionVariable
GetStringTypeW
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
DuplicateHandle
FlushProcessWriteBuffers
VirtualAlloc
VirtualProtect

user32

MessageBoxW

api-ms-win-crt-stdio-l1-1-0

_wfsopen
fputws
__stdio_common_vfwprintf
__stdio_common_vswprintf
_wfopen
setvbuf
__p__commode
_set_fmode
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
ungetc
fgetpos
fgetc
fputc
fwrite
fclose
__acrt_iob_func
fputwc
fflush
fseek
__stdio_common_vsprintf_s

api-ms-win-crt-heap-l1-1-0

realloc
free
calloc
_set_new_mode
malloc
_callnewh

api-ms-win-crt-string-l1-1-0

towlower
_wcsnicmp
wcsncmp
_wcsdup
isupper
islower
_wcsicmp
strcpy_s
strlen
strcmp
wcsnlen
__strncnt
strcspn
wcscmp
wcslen

api-ms-win-crt-convert-l1-1-0

wcstoul
_wtoi

api-ms-win-crt-runtime-l1-1-0

terminate
_beginthreadex
_initterm_e
_initterm
_get_initial_wide_environment
exit
_initialize_wide_environment
_configure_wide_argv
_exit
_errno
_initialize_onexit_table
_register_onexit_function
__p___argc
__p___wargv
_crt_atexit
_c_exit
_cexit
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_set_app_type
abort
_wcserror

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
_lock_locales
_unlock_locales
setlocale
___lc_locale_name_func
localeconv
__pctype_func
___mb_cur_max_func
___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr
exp
ceilf
frexp

api-ms-win-crt-time-l1-1-0

_gmtime64
wcsftime
_time64

api-ms-win-crt-filesystem-l1-1-0

_wremove
_lock_file
_wrename
_unlock_file

Exports

Exports

corehost_initialize
corehost_load
corehost_main
corehost_main_with_output_buffer
corehost_resolve_component_dependencies
corehost_set_error_writer
corehost_unload
hostfxr_close
hostfxr_get_available_sdks
hostfxr_get_native_search_directories
hostfxr_get_runtime_delegate
hostfxr_get_runtime_properties
hostfxr_get_runtime_property_value
hostfxr_initialize_for_dotnet_command_line
hostfxr_initialize_for_runtime_config
hostfxr_main
hostfxr_main_bundle_startupinfo
hostfxr_main_startupinfo
hostfxr_resolve_sdk
hostfxr_resolve_sdk2
hostfxr_run_app
hostfxr_set_error_writer
hostfxr_set_runtime_property_value

Sections

.text
Size: 303KB - Virtual size: 302KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mscordaccore.dll
.dll windows:6 windows

8c06e09ea68c930cefc0e6bd9a0ad685

Code Sign

33:00:00:03:25:48:b2:9d:0e:7f:c5:f4:1f:00:00:00:00:03:25
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:29

Not After

03/03/2021, 18:29

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d5:64:b9:c6:1b:1c:a9:ac:00:05:cb:f2:a4:b3:4a:a8:8b:50:93:fb:23:d2:e7:4e:f0:f4:da:0b:05:78:f1:9a
Signer

Actual PE Digest

d5:64:b9:c6:1b:1c:a9:ac:00:05:cb:f2:a4:b3:4a:a8:8b:50:93:fb:23:d2:e7:4e:f0:f4:da:0b:05:78:f1:9a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\workspace\_work\1\s\artifacts\obj\coreclr\Windows_NT.arm.Release\src\dlls\mscordac\Release\mscordaccore.pdb

Imports

kernel32

CloseHandle
DebugBreak
GetCurrentProcess
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushFileBuffers
WriteFile
ReadFile
HeapFree
GetACP
LCMapStringEx
IsDBCSLeadByte
FormatMessageW
LocalFree
SleepEx
VirtualAlloc
VirtualFree
RaiseException
GetCurrentThreadId
QueryPerformanceCounter
GetSystemTimeAsFileTime
FreeLibrary
GetProcessAffinityMask
SwitchToThread
SetLastError
CreateSemaphoreExW
CreateEventW
WaitForSingleObjectEx
SetEvent
ReleaseSemaphore
LoadLibraryExW
CreateFileW
GetEnvironmentVariableW
GetFullPathNameW
ReadProcessMemory
GetProcessHeap
HeapAlloc
GetSystemInfo
GetProcAddress
InitializeCriticalSection
GetModuleHandleW
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
WideCharToMultiByte
GetLastError
MultiByteToWideChar
DeleteCriticalSection
RtlPcToFileHeader
InitializeCriticalSectionEx
EncodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
InterlockedFlushSList
RtlUnwindEx
RtlLookupFunctionEntry
IsProcessorFeaturePresent
InitializeSListHead
GetCurrentProcessId
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

ole32

CoTaskMemFree
CoCreateGuid
IIDFromString

oleaut32

CreateErrorInfo
SetErrorInfo

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

_wcslwr_s
wcsncpy_s
strnlen
wcsncmp
strncmp
strcmp
strcpy_s
strlen
wcscat_s
strncat_s
wcslen
wcscmp
wcsncat_s
strncpy_s
wcscpy_s

api-ms-win-crt-runtime-l1-1-0

terminate
_errno
_configure_narrow_argv
_initterm_e
_initterm
_initialize_onexit_table
_execute_onexit_table
_seh_filter_dll
_cexit
abort
_initialize_narrow_environment
_invalid_parameter_noinfo

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free

api-ms-win-crt-convert-l1-1-0

wcstoul

Exports

Exports

CLRDataCreateInstance
DacDbiInterfaceInstance
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
OutOfProcessFunctionTableCallback
OutOfProcessFunctionTableCallbackEx

Sections

.text
Size: 673KB - Virtual size: 673KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 310KB - Virtual size: 310KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a892a730ec0b919cad491d223a3914d2

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

0d:c1:72:a6:0f:91:63:1f:95:05:1d:0f:b1:08:ea:dd:a8:5a:10:3f:66:1e:71:e4:2a:f9:75:e5:81:e1:bd:46Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 194KB - Virtual size: 193KB

.rdata Size: 440KB - Virtual size: 440KB

.data Size: 1024B - Virtual size: 1KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

30da1dce0529c017fec28e8c46b39c21

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

c7:58:71:66:4c:ed:32:32:f8:78:bc:96:96:9e:75:fd:bd:46:02:55:77:61:9f:99:af:6f:29:03:01:a5:12:75Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 578KB - Virtual size: 578KB

.rdata Size: 53KB - Virtual size: 53KB

.data Size: 512B - Virtual size: 7KB

.pdata Size: 15KB - Virtual size: 14KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

113a8bec8744f12bc78ee491a9c1e7cb

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

e8:a8:3b:e2:59:c2:34:2c:82:7b:24:83:bd:f2:ed:51:66:67:94:32:42:24:08:62:e6:67:6c:92:a0:19:5a:b8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ole32

oleaut32

user32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

0d:c1:72:a6:0f:91:63:1f:95:05:1d:0f:b1:08:ea:dd:a8:5a:10:3f:66:1e:71:e4:2a:f9:75:e5:81:e1:bd:46
Signer

.text
Size: 194KB - Virtual size: 193KB

.rdata
Size: 440KB - Virtual size: 440KB

.data
Size: 1024B - Virtual size: 1KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

c7:58:71:66:4c:ed:32:32:f8:78:bc:96:96:9e:75:fd:bd:46:02:55:77:61:9f:99:af:6f:29:03:01:a5:12:75
Signer

.text
Size: 578KB - Virtual size: 578KB

.rdata
Size: 53KB - Virtual size: 53KB

.data
Size: 512B - Virtual size: 7KB

.pdata
Size: 15KB - Virtual size: 14KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

e8:a8:3b:e2:59:c2:34:2c:82:7b:24:83:bd:f2:ed:51:66:67:94:32:42:24:08:62:e6:67:6c:92:a0:19:5a:b8
Signer

.text
Size: 2.4MB - Virtual size: 2.4MB

.CLR_UEF
Size: 512B - Virtual size: 164B

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 19KB - Virtual size: 62KB

.pdata
Size: 94KB - Virtual size: 93KB

.didat
Size: 512B - Virtual size: 28B

.clrwb
Size: 512B - Virtual size: 340B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 79KB - Virtual size: 79KB

.text
Size: 303KB - Virtual size: 302KB

.rdata
Size: 154KB - Virtual size: 154KB

.data
Size: 8KB - Virtual size: 10KB

.pdata
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 9KB

33:00:00:03:25:48:b2:9d:0e:7f:c5:f4:1f:00:00:00:00:03:25
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

d5:64:b9:c6:1b:1c:a9:ac:00:05:cb:f2:a4:b3:4a:a8:8b:50:93:fb:23:d2:e7:4e:f0:f4:da:0b:05:78:f1:9a
Signer

.text
Size: 673KB - Virtual size: 673KB